# US 9,438,568 B2 · System and method for email and file decryption without direct access to required decryption key > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,568 B2 - Document ID: US9438568B2 - Status: Granted - Kind: B2 - Application number: 14/066,131 - Filed: 2013-10-29 - Published: 2015-02-05 - Granted: 2016-09-06 - Earliest claimed: 2013-08-02 - Assignees: Zeva Inc. - Applicants: Zeva Incorporated - Inventors: Issam Andoni - Web page: https://patentgrep.com/patent/US9438568B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Exemplary systems and methods are directed to decrypting electronic messages in a network. The system includes a processor configured to receive or monitor message sources for encrypted messages, where private keys associated with the encrypted messages are not previously provided to the system. For each message, extract a set of user certificate identifiers and corresponding encrypted session keys, securely communicate with private key provider to decrypt the encrypted session key with an acquired private key, and decrypt the message with the unencrypted session key. ## Claims ### Claim 1 A system for decrypting electronic messages, comprising: a first processor configured to have a front end processing unit and a back end processing unit, wherein the front end processing unit receives or monitors electronic messages that are in-flight from electronic message sources to downstream destinations on a network for encrypted messages, wherein private keys associated with the encrypted messages are not previously provided to or stored in association with the first processor, wherein for each electronic message the front end processing unit extracts a set of user certificate identifiers and corresponding encrypted session keys, wherein the back end processing unit includes a second processor for executing a hardware security model (HSM), the back end processing unit being configured with access rights to retrieve the private keys from a certificate authority, and for each message the back end processing unit securely communicates with the certificate authority to acquire a private key, which is not previously provided to second processor or stored in the HSM, for decrypting a respective encrypted session key, securely stores the acquired private key in the HSM, decrypts the encrypted session key in the HSM using the private key, and sends the unencrypted session key to the front end processing unit, and wherein the front end processing unit decrypts the encrypted messages with the unencrypted session key. ### Claim 2 A method for decrypting electronic messages in a system having at least one computing device connected to a network, the method comprising: retrieving, via a back end processing unit of the at least one computing device, private keys from a certificate authority, wherein the back end processing unit is configured with access rights to retrieve the private keys; executing, via a processor of the at least one computing device, a hardware security model (HSM); receiving or monitoring, via a front end processing unit of the at least one computing device, a network for encrypted messages that are in-flight from at least one message source to a recipient on the network, wherein private keys associated with the encrypted messages are not previously provided to the system; and for each received message: extracting, via the front end processing unit, a set of user certificate identifiers and corresponding encrypted session keys; via the back end processing unit: securely communicating with a private key provider to obtain a private key, which is not previously provided to or stored in association with the back end processing unit, for decrypting a respective encrypted session key; securely storing the obtained private key in the HSM; decrypting the encrypted session key in the HSM using the private key; and sending the unencrypted session key to the front end processing unit; and decrypting, via the front-end processing unit, the encrypted messages with the unencrypted session key. ### Claim 3 (depends on 2) The method of claim 2, wherein the computing device is configured to execute an application, and wherein extracting the set of user certificate identifiers comprises: requesting, via the front end processing unit, a message header from the application via an input adapter; and decoding the message, via the front end processing unit, and returning the set of user certificate identifiers to a requesting application. ### Claim 4 (depends on 3) The method of claim 3 comprising: requesting from the application, via the front end processing unit, user certificate identifiers of recipients. ### Claim 5 (depends on 4) The method of claim 4, comprising: obtaining, via the front end processing unit, user certificates associated with recipients of the messages from the application. ### Claim 6 (depends on 5) The method of claim 5, comprising: sending, via the front end processing unit, the user certificates to the back end processing unit. ### Claim 7 (depends on 6) The method of claim 6, comprising: requesting, via the application, a decryption token for decrypting the respective encrypted session key. ### Claim 8 (depends on 7) The method of claim 7, comprising: intercepting, via the front end processing unit the request for the decryption token and providing a handle response to the requesting application. ### Claim 9 (depends on 8) The method of claim 8, comprising: sending, via the application, a first request for decrypting the respective encrypted session key based on the handle response. ### Claim 10 (depends on 9) The method of claim 9, comprising: intercepting, via the front end processing unit, the first request and forwarding the intercepted request to a decryption engine. ### Claim 11 (depends on 10) The method of claim 10, comprising: communicating, via the decryption engine, with the back end processing unit to retrieve the unencrypted session key. ### Claim 12 (depends on 1) The method of claim 1, wherein the message is decrypted while message packets are in-flight. ### Claim 13 (depends on 1) The method of claim 1, comprising: retrieving, via the back end processing unit, the private key corresponding to the encrypted session key from a certificate authority over the network; and decrypting, via the back end processing unit, the respective encrypted session key based on the retrieved private key. ### Claim 14 (depends on 13) The method of claim 13, wherein the private key is retrieved on-demand. ### Claim 15 (depends on 14) The method of claim 14, wherein the private key is retrieved automatically. ### Claim 16 A non-transitory computer readable medium for executing a method for decrypting electronic messages in a network, the medium having program code recorded thereon such that when placed in communicable contact with at least one processor, the at least one processor is configured to have a front end processing unit and a back end processing unit and the at least one processor performs the steps of: monitoring, via the front end processing unit, the network for encrypted messages that are in-flight from at least one electronic message source to a recipient, wherein private keys associated with the encrypted messages of the message source are not previously provided to the at least one processor; and for each received message: extracting, via the front end processing unit, a set of user certificate identifiers and corresponding encrypted session keys; the back end processing unit is configured with access rights to retrieve private keys from a key management server and for executing a hardware security model (HSM), wherein the retrieved private keys are not previously provided to or stored in association with the back end processing unit, for the back end processing unit the at least one processor: sending user certificate identifiers to the key management server to obtain a private key for decrypting a respective encrypted session key; and securely storing the obtained private key in the HSM; decrypting the encrypted session key in the HSM using the private key; and sending the unencrypted session key to the front end processing unit, wherein, via the front end processing unit, the at least one processor decrypts the encrypted messages with the unencrypted session key. ### Claim 17 (depends on 16) The method of claim 16, wherein the at least one processor is configured to execute an application, and extracting the set of user certificate identifiers comprises: requesting, via the front end processing unit, a message header from the application via an input adapter; and decoding, via the front end processing unit, the message and returning the set of user certificate identifiers to a requesting application. ### Claim 18 (depends on 17) The method of claim 17 comprising: obtaining, via the back end processing unit, the private key from the HSM. ### Claim 19 (depends on 17) The method of claim 17, comprising: obtaining, via the back end processing unit, the private key on demand from an associated certificate authority.